security(deps): override esbuild to patched version

Add an npm override to pin esbuild >=0.25.0 and refresh the lockfile so Vite no longer pulls the vulnerable 0.21.x series. npm audit now reports zero vulnerabilities for the GHSA-67mh-4wv8-2f99 issue.

Author: TinySnow